keep moving

An inside look into the workings of a cybercrime organization. For an organization that purportedly develops sophisticated malware to steal banking credentials, the lack of basic cyber hygiene led to much info being extracted about their dealings. The irony.

The $5 million reward is being offered for 32 year-old Maksim V. Yakubets, who the government says went by the nicknames “aqua,” and “aquamo,” among others. The feds allege Aqua led an elite cybercrime ring with at least 16 others who used advanced, custom-made strains of malware known as “JabberZeus” and “Bugat” (a.k.a. “Dridex“) to steal banking credentials from employees at hundreds of small- to mid-sized companies in the United States and Europe.

Source: Inside ‘Evil Corp,’ a $100M Cybercrime Menace — Krebs on Security

This is a simple but brilliantly executed heist. Pretend to be the sender by sending from a similar looking domain.

One of the domains was a look-alike of the Chinese investment company’s domain; the other was a spoof of the Israeli firm’s domain. In both instances, the threat actors simply added an “s” to the end of the original domain name.

The next phase of the scam involved the attackers sending two emails with the same subject header as the original email thread about the planned seed funding.

Money meant to fund an Israeli startup wound up directly deposited to the scammers.

Source: How Attackers Used Look-Alike Domains to Steal $1 Million From a Chinese VC

Worryingly, attacks on critical infrastructure is becoming more and more common.

After initial denial, company says report of “malware in system” is correct.

Source: Indian nuclear power plant’s network was hacked, officials confirm

This is brilliant and scary at the same time. I’m always impressed by what Samy can think of. This particular hack makes your computer think a plugged-in Raspberry Pi is an Ethernet device and takes over all your Internet traffic, at the same time poisoning your browser with hijacked copies of Javascripts. This works even on a machine with screen locked.

It is reminiscent of the days of CD-ROM attacks, when your computer will auto-run the contents of a CD-ROM, even when the account is locked.

Source: Samy Kamkar: PoisonTap – exploiting locked computers over USB

This is the right strategy against ransomware. Backup, backup and backup. At the first sign of any ransomware attack it is important to isolate affected machines immediately and contact a cybersecurity professional to mitigate and prevent further infection.

The US city of New Bedford, Massachusetts, rejected a ransom demand of $5.3 million and came back with a counter-offer of $400,000, while restoring encrypted data from backup.

Source: US City Rejects $5.3 Million Ransom Demand and Restores Encrypted Files from Backup (SecAlerts)

When what you can remotely exploit, you can remotely remove.

In a rare feat, French police have hijacked and neutralized a massive cryptocurrency mining botnet controlling close to a million infected computers. The notorious Retadup malware infects computers and starts mining cryptocurrency by sapping power from a computer’s processor. Although the malware was used to generate money, the malware operators easily could have run other […]

Source: Police hijack a botnet and remotely kill 850,000 malware infections – TechCrunch